From: Ruiyu Ni <ruiyu.ni@intel.com>
Date: Mon, 27 Aug 2018 05:22:21 +0000 (+0800)
Subject: EmulatorPkg: IoThunk->Close() is called too early, may causing hang
X-Git-Tag: edk2-stable201903~1092
X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=commitdiff_plain;h=1e57188216b1bf8de3473a0e03e422815f8f53d6

EmulatorPkg: IoThunk->Close() is called too early, may causing hang

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1121

To produce a EFI_BLOCK_IO_PROTOCOL instance in Emulator platform,
EmulatorPkg defines the EMU_IO_THUNK_PROTOCOL. OS dependent layer
needs to produce this protocol implementation and a generic OS
independent layer consumes this protocol to produce
EFI_BLOCK_IO_PROTOCOL.

EMU_IO_THUNK_PROTOCOL can also be used to abstract the OS dependent
IO operation for other UEFI protocols, e.g.: GOP, SimpleFileSystem
and etc.

It contains two interfaces Open() and Close(). Open() creates the
specific IO instances, e.g. for Block IO access, File System access,
Screen access, etc. Close() destroys the specific IO instances.

Later on the Emulator generic module (e.g.: EmuBlockIoDxe) calls
Open() to create the IO instance in DriverBindingStart() and calls
Close() in DriverBindingStop().
But today's implementation of DriverBindingStop() contains a bug
that it calls Close() before uninstalling the EFI_BLOCK_IO_PROTOCOL.

It's a mistake in code. Take EFI_BLOCK_IO for example,
the uninstallation may cause the upper layer driver that consumes
EFI_BLOCK_IO call BlockIo.Reset(), which consequently calls
EmuBlockIo.Reset(). But the EmuBlockIo instance is already destroyed
by Close() that happens before uninstallation.

So a proper implementation is to call Close() after uninstallation
succeeds.

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1121

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Andrew Fish <afish@apple.com>
Reviewed-by: Hao Wu <hao.a.wu@intel.com>
---

diff --git a/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c b/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c
index b9ac6ce080..47b50a8e05 100644
--- a/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c
+++ b/EmulatorPkg/EmuBlockIoDxe/EmuBlockIo.c
@@ -1,6 +1,6 @@
 /**@file
 
-Copyright (c) 2004 - 2009, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2004 - 2018, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -662,7 +662,6 @@ EmuBlockIoDriverBindingStop (
   }
 
   Private = EMU_BLOCK_IO_PRIVATE_DATA_FROM_THIS (BlockIo);
-  Status = Private->IoThunk->Close (Private->IoThunk);
 
   Status = gBS->UninstallMultipleProtocolInterfaces (
                   Private->EfiHandle,
@@ -677,14 +676,17 @@ EmuBlockIoDriverBindingStop (
                     This->DriverBindingHandle,
                     Handle
                     );
-  }
-
-  if (!EFI_ERROR (Status)) {
+    ASSERT_EFI_ERROR (Status);
+    //
+    // Destroy the IO interface.
+    //
+    Status = Private->IoThunk->Close (Private->IoThunk);
+    ASSERT_EFI_ERROR (Status);
     //
     // Free our instance data
     //
     FreeUnicodeStringTable (Private->ControllerNameTable);
-    gBS->FreePool (Private);
+    FreePool (Private);
   }
 
   return Status;
diff --git a/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c b/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c
index b5e19bb840..28abfd6bef 100644
--- a/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c
+++ b/EmulatorPkg/EmuSimpleFileSystemDxe/EmuSimpleFileSystem.c
@@ -866,7 +866,6 @@ EmuSimpleFileSystemDriverBindingStop (
   }
 
   Private = EMU_SIMPLE_FILE_SYSTEM_PRIVATE_DATA_FROM_THIS (SimpleFileSystem);
-  Status = Private->IoThunk->Close (Private->IoThunk);
 
   //
   // Uninstall the Simple File System Protocol from ControllerHandle
@@ -883,9 +882,12 @@ EmuSimpleFileSystemDriverBindingStop (
                     This->DriverBindingHandle,
                     ControllerHandle
                     );
-  }
-
-  if (!EFI_ERROR (Status)) {
+    ASSERT_EFI_ERROR (Status);
+    //
+    // Destroy the IO interface.
+    //
+    Status = Private->IoThunk->Close (Private->IoThunk);
+    ASSERT_EFI_ERROR (Status);
     //
     // Free our instance data
     //
diff --git a/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c b/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c
index 0031baea52..967da9900a 100644
--- a/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c
+++ b/EmulatorPkg/EmuSnpDxe/EmuSnpDxe.c
@@ -870,6 +870,7 @@ EmuSnpDriverBindingStop (
   EFI_STATUS                  Status;
   EMU_SNP_PRIVATE_DATA        *Private = NULL;
   EFI_SIMPLE_NETWORK_PROTOCOL *Snp;
+  VOID                        *EmuIoThunk;
 
   //
   // Complete all outstanding transactions to Controller.
@@ -914,27 +915,42 @@ EmuSnpDriverBindingStop (
   }
 
   Private = EMU_SNP_PRIVATE_DATA_FROM_SNP_THIS (Snp);
-  Status = Private->IoThunk->Close (Private->IoThunk);
+  ASSERT (Private->DeviceHandle == ChildHandleBuffer[0]);
+  ASSERT (Private->EfiHandle    == ControllerHandle);
 
   Status = gBS->CloseProtocol(
-                  ChildHandleBuffer[0],
+                  ControllerHandle,
                   &gEmuIoThunkProtocolGuid,
                   This->DriverBindingHandle,
                   Private->DeviceHandle
                   );
+  ASSERT_EFI_ERROR (Status);
 
   Status = gBS->UninstallMultipleProtocolInterfaces(
-                  ChildHandleBuffer[0],
+                  Private->DeviceHandle,
                   &gEfiSimpleNetworkProtocolGuid,   &Private->Snp,
                   &gEfiDevicePathProtocolGuid,      Private->DevicePath,
                   NULL
                   );
+  if (EFI_ERROR (Status)) {
+    gBS->OpenProtocol (
+           ControllerHandle,
+           &gEmuIoThunkProtocolGuid,
+           &EmuIoThunk,
+           This->DriverBindingHandle,
+           Private->DeviceHandle,
+           EFI_OPEN_PROTOCOL_BY_CHILD_CONTROLLER
+           );
+  } else {
+    Status = Private->IoThunk->Close (Private->IoThunk);
+    ASSERT_EFI_ERROR (Status);
+
+    FreePool (Private->DevicePath);
+    FreeUnicodeStringTable (Private->ControllerNameTable);
+    FreePool (Private);
+  }
 
-  FreePool (Private->DevicePath);
-  FreeUnicodeStringTable (Private->ControllerNameTable);
-  FreePool (Private);
-
-  return EFI_SUCCESS;
+  return Status;
 }